Why aren’t the cache files deleted when Tor is closed, and could they be used to help trace where Tor had been connected to?

There’s a bunch of 'em!


I read about the cached data here.
It’s gibberish to me, but doesn’t seem to address the security question.

  • 1
    It's directory information. It wouldn't be useful for such purposes.
    – cacahuatl
    Jan 10, 2017 at 17:36

1 Answer 1


It's a "hints for future" for your Tor node: these files will speed-up it's reintegration into network when restarted and some possible malicious node attacks - generally based on MitM techniques - can be prevented, i.e. it's maintaining a "known certificates and keys list". There's nothing bad in deleting them, but nothing good either: 10-20Mbytes on disk, rarely accessed - it's not so expensive nowdays to just have it "for good"

  • 1
    I was only concerned with security. The amount of space consumed isn’t even worth mentioning. As long as they don’t leave a trail I don’t care. I really didn’t think the development team would have been so sloppy as to leave a security risk that that, but I had to ask. Jan 12, 2017 at 0:20
  • There's no security risks in deleting these files, you don't have to worry. Even more - no connection/circuit related information is cached in any form in any file
    – Alexey Vesnin
    Jan 12, 2017 at 1:08
  • Of course there’s no risk in deleting the files - that was never a concern. The question was about leaving them in place and the information they contain. After deleting the files then opening Tor to re-create them, there are hundreds of keys/certificates/whatever in the cache files. cached-descriptors.new even contains an IP address from Germany. There appear to be a lot of identifying names in cached-microdesc-consensus. Names like agentsmith, KDFrelayPorterRanch, thebigpenistorrelay, FordModelA, Frijtzwithketchup and on and on... Jan 13, 2017 at 2:46
  • There are thousands of connection names and IP addresses with ports listed in the file. spacebeans 9049 9030, raspberrypi45 9001 9030, oscar 9001, DoctorBigCock 9090, earthling 443 80, Hypocrazy 9001 9030 etc. etc. etc. That appears to be a serious security violation. Jan 13, 2017 at 2:57
  • if you're concerned about even keeping an ip/cert/key lists - use tmpfs for your cache files, then after a poweroff it will be no physical trace of them
    – Alexey Vesnin
    Jan 13, 2017 at 3:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .